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(57) Abstract: A method of authorising an Internet 
Protocol (IP) enabled mobile host (1) to access the 
Internet (2) via a wireless LAN. GSM, or UMTS 
access network (3) comprises initially sending an 
IP access request from the mobile host (1) to an IP 
router (5) widiin the access network (3). In response to 
receipt of said access request at the IP router (5). an IP 
address routing prefix is sent from the IP router (5) to 
the mobile host (1). Electronic cash is then forwarded 
from the mobile hose (1) to a control point (6) ^thin 
the access network (3). The control point (6) confirms 
the authenticity and/or sufficiency of the electronic 
cash and, providing that confirmation is made, sends 
an authorisation message to the IP router (5). The 
IP router (5) blocks the transmission of IP packets 
between the mobile host (1) and the Internet (2) prior 
to rece^)t of the authorisation message and permits 
the passage of IP packets only after an authorisation 
message has been received. 
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MOBILE INTERNET ACCESS 

Field of the Invention 

The present invention relates to mobile Intemet access and in particular, though not 
necessarily, to mobile Internet access with a mobile wireless host. 

Background to the Invention 

With the increasing use of the Intemet, interest has grown in the possibility of accessing 
the Intemet using mobile hosts which are able to roam between access networks. These 
access networics may be networks to which the mobile hosts are connected via fixed 
lines or may be wireless networks to which the mobile hosts are connected using a radio 
interface. Examples of fixed line networks are Ethernet networks whilst examples of 
wireless networks are mobile telephone networks as well as wireless Local Area 
Networks (LANs). 

A difficulty which must be overcome in order to fiilly implement mobile Intemet access 
with roaming, is the need to authenticate and/or authorise a roaming host (or rather the 
subscriber using the mobile host) which uses a foreign network as its access network. It 
is generally envisaged that such a roaming host should belong to a subscriber of some 
other network, i.e. the subscriber's Tiome' network, and that the foreign access network 
must contact this home network in order to authorise the roaming host. 

One disadvantage of this proposal is that it does not enable a mobile host to access the 
Intemet anonymously- Tliat is to say that in order to access the Intemet a roaming host 
must disclose its identity either to the access network or to some other home network. 
Another disadvantage is that a trust relationship must exist betweoi the home network 
and the access network in order that the networks can confidently wcchange billing 
information. Whilst it may be straightforward to establish a trust relationship between 
two telecoms operators for example, it may be more difficult where the access network 
is a wireless Local Area Network operated, for example, in an Intemet caf6. 
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Summary of the Invention 

Accoixling to a first aspect of the invention there is provided a method of acuthorising an 
Intern^ Protocol (IP) enabled mobile host to access the Internet via an access network, 
the method conqirising: 

negotiating an IP address between the mobile host and the access network and/or 
other hosts attached to the access networic; 

sending electronic cash or other authentication message from the mobile host to 
a control point within the access network; and 

confirming at the control point the authenticity of said electronic cash or 
authentication message and, providing that confirmation is made, sending an 
authorisation message from the control point to an IP node, 

wherein the IP node blocks the transmission of IP packets between the mobile 
host and the Intanet prior to receipt of said authorisation message and permits the 
passage of IP packets only after an authorisation message has been received. 

Anonymous access is possible where a mobile host has access to electronic cash which 
can be transferred from the mobile host to the access networic Providing that sufficient 
electronic cash is transferred to the access network, the access network may authorise 
the mobile host to access the Intemet without the need to refer to some other home 
networic of the mobile host. 

It will be i^reciated that the present invention is i^licable in particular to IPv6. 

Preferably, upon receipt of the electronic cash at the control point, the control point 
contacts a bank, or other electronic cash provider or node of the access network, in 
order to authenticate and ensuro the su£5ciency of the received electronic cash. 
Providing that the bank (or cash provida- or other node) returns a confirmation or 
authentication message to the control point, the control point is able to send the 
authorisation message to the IP node in order to allow the passage of IP data packets 
between the mobile host and the Intemet. 
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Preferably, electronic cash payments are incorporated into IP packets sent from the 
mobile host to tiie control point More preferably, the payments are incorporated into 
the option field of IP packets. Other paymmt related messages may also be 
incorporated into IP packets. These include; a price enquiry message sent from the 
mobile host to the control point, a price list message soit &om the control point to the 
mobile host, and a request for fiirther payment also sent from the control point to the 
mobile host. 

As an alternative to the use of electronic cash, the mobile host may transmit a password 
or certificate to the control point. The authenticity of the password or certificate may 
thai be checked with a foreign network operator or the like. 

Preferably, said IP node provides routing functionality for IP data packets. This node 
may also provide for protocol conversion between the carrier protocol used by the 
access network, and that used by the Internet However, where the carrier protocol of 
the access network is compatible with that of the Internet, no such conversion may be 
required. The control point and the IP node may be co-located. Electronic cash or said 
other authentication message may be sent to the control point via the router. The 
payments may be piggybacked onto IP datagrams. Payments or authorisation messages 
may be extracted by the router and forwarded to the control point. 

Preferably, said step of negotiating an IP address is carried out in response to the 
sending of an IP access request Scorn the mobile host to said IP node within the access 
network. Altematively,.the negotiation may be initiated by receipt of a network 
advertisement message broadcast by the access network. 

The step of negotiating an IP address between the mobile host and the access network 
may comprise sending an IP address or part thereof fiom the IP node, or another 
network node, to the mobile host. In certain embodiments, of the present invention, 
subsequent to receipt of the access request at the IP node, the IP node or other network 
node returns to the mobile host an IP address prefix. The remainder of the IP address 
may be provided or generated by the mobile host itself. This remaining part of the IP 
address may be an Intemational Mobile Subscriber Identity (IMSI) code in the case 
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where the access network is a mobile telq)hone network and the mobile host is a mobile 
telephone host or the like. Where the access networic is a fixed line access network, the 
remaining part of the IP address may be the address of the mobile host within that 
network, e.g. an Ethernet address in the case of an Ethernet network. 

Said other network node may be a DHCP server. The control point may be 
incorporated into the DHCP server, so that the e-cash payments are received by the 
DHCP server. The DHCP server sends open and close messages to said IP node to 
unblock or block the flow of IP packets to and from said IP node. 

The term "negotiating" used above encompasses a step of sending a Neighbour 
Solicitation message from the mobile host to other hosts connected to the network. In 
the event that there is an IP address collision, a host may respond by sending a 
Neighbour Advertisement message to the mobile host. 

The access network may be a wireless Local Area Network (LAN) or Wide Area 
Network (WAN). In tiiis case, where the IP node returns a part of an IP address, the 
remainder of the address may correspond to the address of the host in the access 
network, e.g. an Ethernet address. Alternatively, the access network may be a mobile 
telecommunications network such as a GSM network or a UMTS network. 

Preferably, the method of the present invention comprises terr^orarily allocating to the 
mobile host a home ag«t located in the access network. More preferably, this 
allocation exists for the duration of the Internet connection. The home agent is 
responsible for routing datagrams to the mobile host in the event that the mobile host 
roams within the access network and may also rmiain responsible when the mobile host 
roams out of the access network into a new access network. 

Preferably, the method comprises informing an Internet server of the IP address 
allocated to the mobile host, or of an IP address of an allocated home agent. The server 
Tn^mtflins a moping between mobile host identities and temporary IP addresses/home 
agent addresses for subscribing mobile hosts. A correspondent host wishing to 
communicate with the mobile host sends a mobile host identifier to the server. The 
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server may either forward the message to the mobile host or may return the temporary 
address to the correspondent host. In the former case, the Internet server may be a Call 
Control server (using the Session Initiation Protocol (SIP)), vAnlst in the latter case the 
Internet server may be a Domain Name System (DNS) server. 

According to a second inspect of the present invention there is provided apparatus for 
use in enabling an Internet Protocol (IP) enabled mobile host to access the Internet, the 
apparatus comprising: 

means for conducting a negotiation between the mobile host and tiie access 
networic and/or other hosts attached to the access network to allocate a mobile address 
to the mobile host; and 

a control point within the access network for receiving electronic cash or other 
authentication message sent from the mobile host and for confirming the authenticity of 
the sent electronic cash or autfientication message and, providing that confirmation is 
made, for sending an authorisation message to an IP node, 

the IP node being arranged in use to block flie transfer of messages between the 
mobile host and the Internet prior to receipt of an aufliorisation message from the 
control point and being arranged to allow the transfer upon receipt of the authorisation 
message. 

Brief Description of the Drawings 

Figure 1 illustrates schematically a communication system for enabling a mobile IP host 
to access the Internet; 

Figure 2 is a flow diagram illustrating an access method used in the system of Figure 1 . 

Figure 3a illustrates signalling between a mobile host and an Internet access network 

according to a fu^t embodiment of the present invention; 

Figure 3b illustrates fiirther signalling in the embodiment of Figure 3 a; 

Figure 4 illustrates signalling between a mobile host and an Internet access network 

according to a second embodiment of the present invention; 

Figure 5 illustrates signalling between a mobile host and an Internet access network 

according to a third embodiment of the present invention; 
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Figure 6 illustrates signalling between a mobile host, an access network, and the 
Internet, where the mobile host is temporarily attached to the access network; 
Figure 7 illustrates signalling where the mobile host of Figure 6 roams within the access 
network; and 

Figure 8 illustrates signalling whore the mobile host of Figure 6 roams into a new access 
network. 

Detailed Description of Certain Embodimqits 

There is illustrated in Figure 1 a telecommunications system in which a mobile host 1 is 
able to communicate with the Internet 2 by making use of an access network 3. In the 
example to be described here, the access network 3 is a wireless Local Area Network 
(LAN) whilst the mobile host 1 is a mobile wireless host. More particularly, the 
wireless LAN 3 is an Ethemet networic, with the mobile host 1 comprising an Ethernet 
"card" which is programmed with an Ethemet address. Typically this address is 
worldwide unique and is allocated by the card manufacturer. In the example given here, 
the LAN 3 uses the TCP/IP protocol over the Ethemet connection. As an alternative to 
wireless LAN, it will be appreciated that other forms of access networks may be used 
including Wide Area Networics and mobile telecommunications networks (e.g. UMTS 
and GSM networks). 

The wireless LAN 3 is coupled to the Internet 2 via an IP gateway node 4. This 
gateway node 4 is in tum connected to a number of "primary" IP routers S (only one of 
which is shown in the Figure) within the wireless LAN 3. Each of the primary IP 
routers 5 provides a gateway between the Ethemet LAN and the IP "world". This 
function involves protocol conversions if necessary. In addition, the primary routers 5 
are involved in the allocation of IP addresses to the mobile hosts, which addresses are 
world-wide unique. 

For the purpose of this example, it is assumed that the mobile host 1 does not have a 
subscription with the operator of the wireless LAN 3 or with any other network (e.g. 
LAN, WAN. telephone network etc) with which the wireless LAN 3 has a billing 
relationship. That is to say that the mobile host 3 does not have a "home" network. 
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When the mobile host 1 is within the radio coverage area of the wireless LAN 3 and is 
switched on, the mobile host 1 att«ipts to'make a normal attachment to the wireless 
LAN 3. It does this via radio transceiver stations which are not illustrated in Figure 1 . 
The mobile host 1 initiates a negotiation with one of the primary routers 5 (typically the 
router which is physically closest to the radio transceiver station which handles the 
host's access), requesting in message Ml an IP address routing prefix fix)m the router. 
In the case of Internet Protocol version 6 (IPv6), this prefix contains 64 bits and is 
returned by the router 5 as message M2 to tfie mobile host 1 over the radio interface. In 
order to generate a complete IPv6 address, the mobile host 1 adds to the routing prefix 
an address part which is unique to the mobile host L This part may be generated, for 
example, using the Ethernet card address of the mobile host 1. 

Following the return of the IPv6 address prefix bom the router 5, and the formulation of 
the complete IP address, the router 5 does not immediately start coupling IP data 
packets between the mobile host 1 and the Internet 2. Rather, the router 5 awaits 
authorisation of the access request from a control point 6 to which the router 5 is 
connected. 

The authorisation process at the control point 6 is conducted as follows. Firstly, upon 
receipt of the IP routing prefix from the router 5, the mobile host 1 transmits an amount 
of electronic cash (e-cash) M3 to the control point 6 via the radio transceiver station 
(and possibly via the router 5). The e-cash is accompanied by the IP address now 
allocated to the mobile host 1 . In order to verify the amount and authenticity of the e- 
cash, the control point 6 contacts a bank or other e-cash provider 7 which is responsible 
for the transmitted e-cash. This may involve sendmg a certificate M4, which 
accompanies the e-cash, to the bank or e-cash provider 7. In the event that the amount 
of e-cash is insufficient, or the bank or e-cash provider 7 returns a message M5 
indicating that the e-cash is not authentic, the control point 6 will return a fail message 
M6 to the mobile host 1 (possibly via the router 5) indicating that the access request is 
denied. The control point 6 will then notify the responsible router 5 of this situation. 

Assuming on the other hand that the amount of e-cash sent to &e control point 6 is 
sufficient, and that the bank or e-cash provider 7 returns in message M5 confirmation 
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that the e-cash is authmtic, the control point 6 will transmit an authorisation message in 
message M6 to the responsible router 5. Upon receipt of the authorisation message, the 
router will start to relay IP packets between the mobile host 1 and the Internet 2. The 
mobile host 1 is ttien able to exchange DP data packets with a correspondent host 8, via 
the IntCTiet. 

Figure 2 is a flow diagram illustrating further ttie authorisation process described above. 

The process described above, where an IP address is generated by the mobile host 1 
itself, is referred to as "stateless address allocation". Figure 3a illustrates the signalling 
involved in this scenario where it is assumed that the control point 6 is integrated into 
the router 5 (i.e. in the following discussion it is assumed that commimications 
regarding e-cash may be exchanged between the router 5 and the control point 6). The 
mobile host 1 first sends a Router Solicitation message to the router 5 of the access 
network 3, An e-cash enquiry message is "piggybacked" onto the Router Solicitation 
message. The router 5 responds with a Router Advertisement message telling the 
mobile host 1 how it must obtain an IP address. In addition, e-cash pricing information 
is placed in an option field of the Router Advertisement message. The mobile host 1 
learns from this message whether the charging is time-based or volume-based, the exact 
pridng for IP address leasing (e.g. per minute or per kilobyte), and which types of e- 
cash payment the access network 3 will accept. 

The mobile host 1 is able to accept or reject the terms proposed by the network 3. If the 
trans are accepted, the received information is used to set the e-cash "module" in the 
mobile host 1 so that the host 1 pays the correct amount of e-cash. The mobile host 1 
generates an IP address and validates the address by broadcasting a Neighbour 
Solicitation message. All of the other hosts connected to the access network 3 listen to 
this message and will issue a Neighbour Advertisement message if the generated IP 
address corresponds to an already allocated address (alternatively the Neighbour 
Advertisement message may be sent to a server in the access network which records 
currently allocated IP addresses). In the event that thwe is no reply to the Neighbour 
Solicitation message, the mobile host 1 starts to send data through the router 5. E-cash 
is paid to the network 3 by piggybacking e-cash payments onto datagrams sent through 
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the router S. Typically, e-cash paymmts aie sent at intervals, as requested by the router 
5 in the Router Advertisement message. 

The router 5 extracts the e-cash payment from received datagrams and checks the 
validity of the payment as described above (using the services of the control point 6). 
Assuming tiiat the access is authorised on the basis of the received payment, the basic 
datagram is then forwarded to the intended correspondent host 8 over the Internet 2. It 
is possible that an e-cash payment may run out if the mobile host 1 has not strictly 
obeyed the tenns provided by the router S. In this case, the router 5 may send a notify 
message to the mobile host 1 just prior to the payment running out, reminding the 
mobile host 1 to make a further payment. The mobile host 1 should respond with a 
further payment A Request for Immediate Payment message may be sent to the mobile 
host 1 by the router S in the event that a payment has already run out, notifying the 
mobile host 1 of tfiis fact and that the router 5 has started to discard received datagrams 
sent from (or to) the mobile host 1. This scenario is illustrated in Figure 3b. 

It is noted that piggybacked payment related messages, such as a price enquiry or an e- 
cash payments, may be included into the IPv6 extoision header (e.g. the "Hop-by-Hop" 
option field) of an IP datagnun. 

Figure 4a illustrates an alternative scenario to the stateless address allocation scenario 
described above. This is referred to as "statefiil address allocation" and uses a server 
(not shown in Figure 1) in the access network 3 which maintains a list of all of the IP 
addresses allocated by the network 3. A protocol known as Dynamic Host 
O)nfiguration Protocol (DHCP) has been specified by the Internet Engineering Task 
Force (IETF) for negotiating stateful address allocation between the server (DHCP 
server) and the mobile host 1. As with the stateless address allocation scenario, the 
process commences with the sending of a Router SoUcitation message, containing a 
piggybacked price enquiry, from the mobile host 1 to the Router 5. The Router 5 again 
rq)lies with a Router Advertisement message, containing a piggybacked price list. The 
mobile host 1 learns from the Router Advertisement message that it must obtain an IP 
address from the DHCP server. It does this using the DHCP protocol, and thereafter e- 
cash payments are piggybacked on IP datagrams sent to the router S (from where they 



wo 00/76249 PCT/SEOO/01136 

10 

are salt to the control point). Reminder and Request for Immediate Payment messages 
can be sent horn the router 5 to the mobile host 1. 

It will be 2q)preciated that in flie scenario desaibed above, the DHCP server does not 
require any modification to implement the invention. However, in order to facilitate 
time-based charging, a modification may be required to the DHCP server. This takes 
advantage of the fact that BP addresses allocation by the DHCP server normally have a 
limited lifetime. After a lifetime has expired, the mobile host must renew the IP address 
allocation. E<ash payments in respect of IP address roiewals may be piggybaxdced on 
DHCP address renewal messages. 

Two new control messages are required; an Open Route message and a Close Route 
message. These messages are sent 6om the DHCP server (acting as control point for 
the IP router) to the router to tell the router either to acc^t or discard datagrams 
received fiom (or sent to) the mobile host. This scenario requires that e-cash 
fimctionality be incorporated into the DHCP server, with "opening" and "closing" route 
fimctionality being incorporated into the router. Figure 5 illustrates the modified 
scoiario. 

The system described above works satisfactorily whilst a mobile host remains within 
one homogeneous network. However, it does not by itself provide for "roaming" 
brtween different types of access networks or between networks operated by different 
operators. When a mobile host "de-registers" with one network and registers with a 
new networic, fliere is no medianism for forwarding Internet datagrams, addressed to the 
old network, to the new network as the communication channel between the mobile host 
and tiie old networic no longer exists. It is therefore necessary to open a new 
communication channel between the mobile host and the new network. All datagrams 
addressed to the old network and not yet received by the mobile host are lost as a result 
of this channel change. This is obviously not feasible for applications such as voice 
over IP or video telephony, and may also cause real problems for other applications 
sudi as www browsers and file transfos. 
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A mobile Internet access protocol (IPv6) which provides for roaming is cxirrently being 
standardised by the Internet Enginemng Task Force (IETF). This protocol makes use 
of a •*home agent", located m a mobile host's home network (i.e. the network to which 
the mobile host subscribes), to keep track of the host when it leaves the home network. 
A mobile host is fixedly allocated an Internet address (or name) corresponding to the 
home networic. 

When a mobile host is registered with its home netwoik, the fimctionality of the 
network's home agent is off for that host (i.e. the host is "deregistered'* with the home 
agent) so that the home agent does not alter the flow of datagrams from the Internet to 
the network's router and the mobile host. When the mobile host leaves its home 
network and contacts a foreign network (FN), the host is allocated a temporary IP 
address by the foreign network. The mobile host then transmits the received Internet 
address to the home network's home agent, together with a registration instruction. The 
home agent registers the new status of the mobile host and records the newly allocated 
Internet address as a "care-of-addiess" for the host. Whenever the mobile host registers 
with a new foreign network, a new care-of-address is sent to the home network's home 
agent to replace the previously registered care-of-address. 

It will be appreciated that, as a mobile host has a fixed Internet address allocated to it, 
datagrams destined for the host will at least in the first instance be sent to the home 
network (the mobile host may subsequently issue a Binding Update notification to the 
Correspondent host allowing direct communication between the two hosts). If a mobile 
host has an active Internet coimection when it passes fi-om its home network to a foreign 
network, and a datagram destined for the host subsequently arrives at the home network, 
the home agent determines that the mobile host is registered with a foreign network and 
forwards the datagrams to the registered care-of-address. Similarly, if a mobile host 
initiates a new Internet access when registered with a foreign network, the host 
continues to use its allocated Internet address. The home agent has already recdved the 
care-of*address and can again forward datagrams destined for the mobile host to the 
foreign network for transfer to the host. 
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The functionality described above may be implraiented in embodiments of the present 
invention by temporarily allocating a home agent in an access network to a mobile host, 
where that host has been authorised to use the access network by the payment of e-cash 
or the like. The allocated home agent acts like a normal home agent for the host, except 
that when the connection is tominated, e.g. because a payment runs out, the mobile host 
is deleted from the set of mobile hosts serviced by the home agent. In order to enable 
correspondent hosts to be able to communicate with a mobile host making use of a 
dynamically allocated home agent, use is made of a Domain Name System (DNS) 
server in the Internet which provides a "real" home for the mobile host The DNS 
server is notified of the temporary addresses of mobile hosts (which subscribe to the 
service offered by the DNS server) and maps these to respective permanent IP names of 
the mobile hosts (e.g. myniobile.dnsserver.com). 

With reference to Figure 6, the following four steps can be identified in establishing a 
connection between a mobile host (MH) and a correspondent host (CH). The mobile 
host attaches (step 1) to the access network via an access point (AP|) as described above 
with reference to Figures 1 to 5 (where the access point is a router). The mobile host is 
allocated a home agent (HA) which is notified of the DP address temporarily allocated to 
the mobile host The mobile host notifies (step 2) the DNS (to which it subscribes) of 
the temporary address which it has been allocated. The DNS maps this address to a 
permanent IP name of the mobile host 

A correspondent host sends (step 3) an IP address discovery message to the DNS server, 
the message including the mobile host's IP name (e.g. mymobile.dnsserver.com). The 
DNS server identifies the current temporary address of the mobile host The DNS 
server then returns a message to the correspondent host advising it of the temporary IP 
address of the mobile host Once the correspondent host is aware of the temporary 
address of the mobile host, communication (step 4) can begin between the mobile host 
and the correspondent host. 

Two roaming scenarios which make use of the home agent are illustrated in Figures 7 
and 8. In Figure 7, a mobile host moves (step 1) within the same access network. As a 
result of this move, the host connects (step 2) to a new access point (AP2) and receives a 
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new tempoiaiy IP address. The mobile host notifies (step 3) the home agent of its new 
temporary address. When a correspond^t host sends an IP address discoveiy message 
to the DNS server, as the DNS server has not been updated with the new temporary IP 
address of the mobile host, but rather still retains the original temporary IP address 
(allocated by APi), the correspondent host is notified of the old temporary IP address 
and thereafter communicates (step 5) directly witti the home agent. The home agent 
handles the routing of received packets to the mobile host by ms^ping the old 
temporaiy address to the new temporaiy address. The mobile host may subsequratly 
conununicate directly (step 6) with the correspondent host in the event that the fonner 
send a Binding Update message to the latter. When a mobile host is allocated a new 
temporaiy address during an ongoing IP commimication, a Binding Update message 
may be used to inform the correspondent host of the new address. 

In the scenario of Figure 8, the mobile host roams (step 1) &om a first to a second 
access network. Assuming that the mobile host has been authorised for such roaming 
by the first access network, the home agent allocated to the mobile host in the first 
network remains responsible for the host even after it has entered the second network. 
Thereafter, steps 2 to 6 for the scenario of Figure 8 are substantially the same as for the 
scenario of Figure 7, with datagrams fix>m the correspondent host being routed through 
the home zgeat of the first netwoik in the first instance. In this scenario, the mobile 
host may be required to make an additional payment to the new access network in order 
to CTable it to make use of the available IP services. 

It will be appreciated by the person of skill in the art that various modifications may be 
made to the above described embodiments without departing fiom the scope of the 
present invention. For example, whilst the above description assumes that the IP 
address allocation procedure is initiated by the sending of a Router Solicitation message 
fi:om the mobile host to an IP router, it is possible that the process may be initiated by 
receipt at the mobile host of a broadcast Router Advertisement message. Rather than 
send a Router Solicitation message, the mobile host merely listens for Router 
AdvertisCTient messages which are broadcast periodically be the access netwoik. 
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Claims 

1 . A method of authorising an Internet Protocol (IP) enabled mobile host to access 
the Internet via an access network, the method comprising: 

negotiating an IP address between the mobile host and the access network and/or 
oth^ hosts attached to the access network; 

sending electronic cash or otiier authentication message from the mobile host to 
a control point within the access network; and 

confirming at the control point the authenticity of said electronic cash or 
authmtication message and, providing that confirmation is made, sending an 
audiorisation message from the control point to an IP node, 

wherein the IP node blocks the transmission of IP packets between the mobile 
host and the Tntemet prior to receipt of said authorisation message and permits the 
passage of IP packets only after an authorisation message has been received. 

2. A method according to claim 1 , wherein said step of negotiating an IP address is 
carried out in response to the sending of an IP access request from the mobile host to 
said IP node within the access network. 

3. A m^od according to claim 1 or 2 and comprising routing IP data packets at 
said IP node. 

4. A method according to claim 3 and comprising carrying out a protocol 
conversion at the IP node between the carrier protocol used by the access network, and 
that used by the Internet. 

5. A method according to any one of the preceding claims and comprising, upon 
receipt of the access request at the IP node, returning from the IP node to the mobile 
host an IP address prefix. 
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6. A method according to any one of claims I to 4, wherein said step of negotiating 
comprises carrying out a negotiation between the mobile host and a DHCP server of the 
access network* 

7. A method according to any one of the preceding claims, wherein the access 
networic is a wireless Local Area Network (LAN), Wide Area Network (WAN), UMTS 
network or GSM network. 

8. A method according to any one of the preceding claims, wherein, upon receipt 
of electronic cash at the control point, the control point contacts a bank, or other 
electronic cash provider, to authenticate and ensure the sufficiency of the received 
electronic cash and, providing that the bank or cash provider returns a confirmation or 
authentication message to the control point, the control point sends the authorisation 
message to the IP node in order to allow the passage of IP data packets between the 
mobile host and.the Internet 

9. A method according to any one of the preceding claims and comprising 
incorporating electronic cash payments into IP packets sent fi-om the mobile host to the 
control point. 

10. A method according to any one of the preceding claims, wherein said IP node is 
an IP router. 

11. A method according to claim 9, wherein the IP router is co-located with the 
control point. 

12. A method according to claim 9, wherein said control point is co-located with a 
DHCP server, the DHCP server allocating an IP address to the mobile host during the IP 
address negotiation. 

13. A method according to any one of the preceding claims and comprising 
temporarily allocating to the mobile host a home agent located in the access network. 
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14. A method according to claim 1 3, wherein the allocation of the home agent exists 
for the duration of the Internet connection. 



15. A method according to any one of the preceding claims and comprising 
infomiing an Internet server of the IP address allocated to the mobile host, the server 
maintaining a mzipping between mobile host identities and temporary IP addresses for 
subscribing mobile hosts. 

16. A method according to claim IS, wherein the Internet server is a Domain Name 
Server (DNS). 

17. A method according to any one of claims 1 to 14 and comprising infozming an 
» ' Internet server of the location of the mobile host, the server maintaining a mapping 

between mobile host identities and locations for subscribing mobile hosts. 

18. According to a second aspect of the present invention there is provided 
apparatus for use in enabling an Internet Protocol (DP) enabled mobile host to access the 
Internet, the s^paratus comprising: 

means for conducting a negotiation between the mobile host and the access 
network and/or other hosts attached to the access network to allocate a mobile address 
to the mobile host; and 

a control point within the access network for receiving electronic cash or other 
authentication message sent from the mobile host and for confirming the authenticity of 
the seat electronic cash or authentication message and, providing that confinnation is 
made, for sending an authorisation message to an IP node, 

the IP node being airanged in use to block the transfer of messages between the 
mobile host and the Intonet prior to receipt of an authorisation message from the 
control point and being arranged to allow the transfer upon receipt of the authorisation 
message. 
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